Harden mainnet origin and alternative-origin validation

[zeropath-ai]

insertLoginForm() now treats any hostname whose suffix matches icp0.io, ic0.app, or icp.net as a trusted mainnet origin by using window.location.hostname.endsWith(domain). That accepts attacker-controlled lookalike domains such as evilicp.net. Because check_alternative_origin() only fetches /.well-known/ii-alternative-origins from the current origin and checks whether that origin lists itself, an attacker-controlled suffix-matching site can satisfy the check trivially, causing the code to auto-set derivationOrigin to https://<canister-id>.<matched-domain> and use the production II provider. In practice, a phishing site hosted on a suffix-matching domain can make users authenticate via Internet Identity while the app receives a delegation scoped as the target canister origin, letting the attacker use the victim's identity against that canister. Trusted mainnet detection needs an origin boundary check (exact host or .-delimited subdomain) and the alternative-origin proof should be tied to the target canister origin, not self-asserted by the current page.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 8f2ee94.

Security Overview

• 🔎 Scanned files: 1 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/7ddf29dd-76dc-4f78-adfa-47ac8f4643e7?scanId=349f9241-9603-4b80-89c5-5b7696e30030&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► tools/ui/src/auth/auth.ts     Enable alternative origin check via canisterOrigin and adjust login form origin handling

[Copilot]

🟢 Approval recommended

The focused changes correctly address both reported origin-validation vulnerabilities.

Pull request overview

Hardens Internet Identity origin validation against lookalike-domain attacks.

Changes:

• Requires exact or dot-delimited mainnet domain matches.
• Validates alternative origins against the target canister.

File summaries

File	Description
tools/ui/src/auth/auth.ts	Secures mainnet detection and alternative-origin verification.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.